With Windows Server 2008 R2 just around the corner, let's take a look at one of the unheralded areas of improvement for the new OS (along with Windows Server 2008) -- Group Policy. In this article, I'll break down some of the new pieces of Group Policy that have recently been added to Windows Server.
Windows PowerShell cmdlets for Group Policy
New in Windows Server 2008 R2 is a set of PowerShell cmdlets that can be used via the Group Policy Management Console (GPMC). The cmdlets will allow you to automate many of the same tasks that you usually perform in the graphical user interface (GUI). Some of the new cmdlets include the ability to manage aspects of your Group Policy deployment in the following areas:
- GPO maintenance (creating, removing, backing up, and importing GPOs)
- linking Group Policy Objects with Active Directory containers, as well as updating and removing those links
- controlling inheritance and permissions of AD organizational units (OUs) and domains
- Managing — including creating and editing — both Starter GPOs and Group Policy preferences, which are new Group Policy features from the "2008 era" of server releases
Let's take a closer look at the latter two newer features.
Starter Group Policy Objects
Starter Group Policy Objects were first introduced in Windows Server 2008 Gold, and have now been refined for Windows Server 2008 R2.
They are designed so that you can quickly deploy GPOs based on commonly used configurations. These starter objects have pre-configured settings, each of which are well-commented on, making it very easy to deploy a consistent set of baseline configurations. Think of starter GPOs as quick-start templates which you can build on to create your custom set of GPOs specif...
To continue reading for free, register below or login
To read more you must become a member of SearchWindowsServer.com
ic to your environment.
You'll need to create the Starter GPOs folder in each domain, which is an easy process. In the Group Policy Management Console, simply expand the appropriate forest and domain, and then click Starter GPOs. Then, in the right pane, click the Create Starter GPOs folder. You'll only need to do this once per domain. Essentially, this step creates a folder called "StarterGPOs" inside the SYSVOL folder at this path:
To create a new starter GPO (akin to creating the "template" from which your future GPOs will originate), right-click on Starter GPOs and choose New from the context menu. Enter a name for the GPO and a description, which will also migrate to future GPOs, and then click OK.
Creating a GPO based on these Starter GPOs is simple. Just choose the appropriate Starter GPO from the Source Starter GPO list in the New Group Policy Object window. The settings will automatically drop down to your new GPO from the Starter GPO at that point.
Group Policy preferences
Windows Server 2008 R2 also incorporates enhancements to a feature called Group Policy preferences. This is essentially a new form of the old PolicyMaker Standard Edition and Policy Share Manager, which have been put directly into the Group Policy Management Console. In a nutshell, preferences allow you to "suggest" an initial configuration to your users while still giving them the ability to change it.
Let's delve a little deeper into this.
Group Policy itself was designed so that an administrator can determine and set up his or her mandatory environment, configure it appropriately for the organization's needs, and then leave it up to Windows to strictly enforce those settings. Group Policy generally overrides any user-provided settings in the event of a conflict, and it typically disables any user interface functions that could be used to change those settings. While one can limit or otherwise affect the scope of a GPO, it essentially can touch every machine that is a member of any given Windows domain. Machines and settings controlled by Group Policy are termed managed machines and settings.
Group Policy preferences offers a bit of a lighter approach. While Group Policy preferences are still set up by an administrator and filtered down to managed clients, Group Policy now writes preferences to the same places in the Registry where applications store their data about that specific setting. This lets Group Policy address settings and switch in applications that don't know about Group Policy by default.
In addition, there is no restriction on the user interface of the software. Therefore, if any administrator-defined preferences don't meet a user's working style -- or in some other way aren't what a user wishes -- he or she is free to change them.
You can also define the schedule at which Group Policy refreshes preference information. This can either be done at the same interval that Group Policy refreshes the mandatory settings, or you can set it once and then prohibit Windows from refreshing that preference again.
You can create preference entries by right-clicking on the appropriate preference item in the left pane of the Group Policy Management Editor and selecting New from the context menu. The same breakdown for regular GPOs applies for Group Policy preferences: Computer Configuration is used to customize machine-specific settings, which become effective when a computer first boots, and User Configuration is used to configure settings that apply only to that user regardless of where he or she is on the network.
[IMAGE]Jonathan Hassell is an author, consultant and speaker residing in Charlotte, N.C. Jonathan's books include RADIUS, Learning Windows Server 2003, Hardening Windows and most recently Windows Vista: Beyond the Manual.
